CVE-2024-5391: Online Student Enrollment System SQLi Flaw

CVE-2024-5391 Overview

CVE-2024-5391 is a SQL injection vulnerability in itsourcecode Online Student Enrollment System 1.0. The flaw resides in the listofsubject.php script, where the subjcode parameter is passed directly into a database query without proper sanitization. Attackers can manipulate the parameter to inject arbitrary SQL statements. The vulnerability is remotely exploitable and requires only low-privileged authentication. Public disclosure has occurred through VulDB entry VDB-266305 and a GitHub issue report, increasing the likelihood of opportunistic exploitation against exposed installations.

Critical Impact
Authenticated remote attackers can execute arbitrary SQL queries against the backend database, exposing student records, credentials, and enrollment data.

Affected Products

itsourcecode Online Student Enrollment System 1.0
Component: listofsubject.php
Vulnerable parameter: subjcode

Discovery Timeline

2024-05-27 - CVE-2024-5391 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5391

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw categorized under [CWE-89]. The listofsubject.php endpoint accepts the subjcode argument from user-controlled input and concatenates it into a SQL query. Because the application does not use parameterized queries or input filtering, attackers can break out of the intended query context.

Exploitation requires network access to the application and low-level authentication. Successful attacks compromise confidentiality, integrity, and availability of the underlying MySQL database. Attackers can enumerate schema information, dump records using UNION SELECT payloads, or modify data through stacked queries where supported.

The EPSS score of 0.622% reflects moderate exploitation likelihood. Public exploitation details are disclosed via VulDB entry #266305 and a corresponding GitHub issue.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The listofsubject.php script passes the subjcode HTTP parameter directly into a query string without prepared statements or input validation. Standard PHP mysqli or PDO parameterized query patterns are absent.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the listofsubject.php endpoint with a malicious subjcode value. Injection payloads may include boolean-based, union-based, or time-based blind SQL injection techniques. Because the attack traverses the network with low attack complexity, automated scanners and off-the-shelf tools like sqlmap can identify and exploit the issue. See the GitHub Issue Report for public proof-of-concept details.

Detection Methods for CVE-2024-5391

Indicators of Compromise

HTTP requests to listofsubject.php containing SQL metacharacters such as ', ", --, UNION, or SLEEP( in the subjcode parameter.
Unusual MySQL error messages returned in application responses referencing syntax near the subjcode value.
Elevated query volume or long-running queries originating from the enrollment application database user.
Web server logs showing repeated requests to listofsubject.php from a single source with varying query strings.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection signatures targeting the subjcode parameter.
Enable MySQL general query logging or slow query logs and alert on UNION SELECT, INFORMATION_SCHEMA, or BENCHMARK patterns.
Correlate application error responses with request payloads to surface injection probing behavior.

Monitoring Recommendations

Monitor outbound data volume from the database server to identify bulk record extraction.
Alert on authentication events from application accounts followed by anomalous query patterns.
Track file access to listofsubject.php for unusual request frequency or geographic origin.

How to Mitigate CVE-2024-5391

Immediate Actions Required

Restrict network access to the Online Student Enrollment System to trusted internal networks or via VPN until a patch is available.
Deploy WAF rules to block SQL injection payloads targeting the subjcode parameter in listofsubject.php.
Rotate database credentials and audit application accounts for signs of prior compromise.
Review recent database logs for unauthorized SELECT, UPDATE, or DROP operations.

Patch Information

No vendor advisory or official patch has been published by itsourcecode at the time of writing. Administrators should monitor the VulDB entry #266305 and the GitHub Issue Report for remediation updates. In the absence of a patch, apply source-level fixes by refactoring listofsubject.php to use parameterized queries with mysqli_prepare() or PDO prepared statements.

Workarounds

Modify listofsubject.php to validate that subjcode matches an expected format such as alphanumeric only.
Apply database-level least-privilege controls so the application account cannot access INFORMATION_SCHEMA or execute administrative statements.
Place the application behind a reverse proxy that enforces strict input validation on query parameters.
Consider taking the application offline if it is not business-critical until a vendor fix is released.

bash

# Example WAF rule (ModSecurity) blocking SQL injection on subjcode parameter
SecRule ARGS:subjcode "@detectSQLi" \
    "id:1005391,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2024-5391 SQLi attempt on listofsubject.php',\
    logdata:'Matched value: %{MATCHED_VAR}'"